Input Validation Flaw in Arduino App Lab Terminal Component
CVE-2026-25933

6.9MEDIUM

Key Information:

Vendor

Arduino

Status
Arduino-app-lab
Vendor
CVE Published:
12 February 2026

What is CVE-2026-25933?

An input validation vulnerability exists in the Terminal component of Arduino App Lab prior to version 0.4.0. This issue arises from insufficient sanitization of data received from connected hardware devices. Specifically, the _info.Serial and _info.Address metadata fields are vulnerable, allowing an attacker with physical access to a tampered board to inject malicious payloads. If these parameters are not properly validated, injected commands can be executed with the privileges of the user running the application, posing significant security risks. Upgrading to version 0.4.0 mitigates this issue effectively.

Affected Version(s)

arduino-app-lab < 0.4.0

References

https://github.com/arduino/arduino-app-lab/security/advis...
x_refsource_CONFIRM
https://github.com/arduino/arduino-app-lab/releases/tag/a...
x_refsource_MISC

CVSS V3.1

Score:
6.9
Severity:
MEDIUM
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Physical
Attack Complexity:
High
Privileges Required:
High
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.